jinxy wrote:
> Hello, I am in need of some help in solving this issue. Whenever I
> attempt to open something from the desktop, I get the following
> message: Example_C:\documents and settings\ allusers\ desktop\
> malwarebytes antimalware.ink The NTVDM CPU has encounter an illeagl
> instruction, cs:0538 ip: 0176 op: 632c 32 6c 75 close or ignore.
> When the pc first boots up there are about 15 of theses little black
> windows, and most of them say : C:\documents\nick\application\adobe
> \plugs\mmc17.exe.
> I also cannot use any icon in the control panel, when I try to I get
> C:\windows\system32\rundll32.exe the parameter is incorrect.
> This pc is an Intel Celeron running XP home , I think sp3may be
> installed. Any help would be great.
> Thanks
> jinxy
"NTVDM CPU Has Encountered an Illegal Instruction"
http://support.microsoft.com/kb/245184
"When you attempt to run a 16-bit program..."
But that article is for an older OS. The question would be,
why is an attempt to launch a regular program, being interpreted
as a 16 bit program ?
In this example, they just rename the offending executable, to
make the error go away.
http://www.techimo.com/forum/technic...struction.html
"Troubleshooting NTVDM and WOW Startup Errors"
http://support.microsoft.com/kb/q196453/
"Check the Autoexec.nt and Config.nt for anything unusual"
This is my Config.nt contents (from a WinXP SP3 system):
dos=high, umb
device=%SystemRoot%\system32\himem.sys
files=40
This is my Autoexec.net:
REM Install CD ROM extensions
lh %SystemRoot%\system32\mscdexnt.exe
REM Install network redirector (load before dosx.exe)
lh %SystemRoot%\system32\redir
REM Install DPMI support
lh %SystemRoot%\system32\dosx
SET BLASTER=A220 I5 D1 P330 T3
I copied the files into a separate folder, then dropped them onto
an open Notepad window.
But that article also implicates a lot of other files as
being part of the problem.
Chances are, it's malware, but you never know, it might be
something entirely different.
Example of a malware using Adobe\plugs\mmc17.exe
http://vil.nai.com/vil/content/v_508913.htm
Try an offline scan, and see what it finds. Boot a Kaspersky CD.
http://support.kaspersky.com/faq/?qid=208282163
Iso image of Kaspersky Rescue Disk 10 (196 MB)
You'll need another computer to prepare that disc. Or,
if you have some other Linux LiveCD with CD burning program,
that would also be a way to use your current computer, to
prepare the scanning CD.
That disc, when booted, will make a network connection via DHCP.
If you have ADSL or Cable modem, with a router or routing function,
that will support DHCP. Kaspersky doesn't support dialup networking
for obtaining up to date virus definitions.
When using an application like that, be careful with what it quarantines.
If it places quarantined files on a ramdisk, they'll be destroyed on
the next reboot. Make sure the quarantined files are safe somewhere,
in case you need to move them back later for some reason.
The Kaspersky disc takes 2 hours to scan a 50GB partition, so it
takes time. Be patient.
Paul
Similar Threads
